fix(release): embed MPL distribution notices

Author: Codewriter90x

docs/development/macos-playtest-package.md

@@ -14,7 +14,9 @@ Build and package it with Unity `6000.5.6f1`:
 The script builds the native plug-in, synchronizes Core, invokes the checked-in
 Unity build method, embeds the arm64 plug-in, applies an ad-hoc signature,
 verifies the bundle, and creates a resource-fork-safe ZIP under
-`artifacts/game/`.
+`artifacts/game/`. The application and ZIP include `Legal/` with the MPL text,
+project and third-party notices, and `SOURCE-CODE.txt`, which identifies the
+exact public Git revision corresponding to the build.
 
 This playtest packaging is intentionally not a production distribution flow.
 Unity gives the local build an ad-hoc signature, but downloading it on another

docs/development/macos-signing-notarization.md

@@ -72,7 +72,10 @@ is the simpler and safer release procedure.
 `build-macos-distribution-app.sh` builds the native arm64 CoreMIDI plug-in,
 synchronizes the managed Core assembly, and asks Unity to create a non-
 Development macOS player. The bundle identifier remains
-`com.codewriter90x.hitthekit`.
+`com.codewriter90x.hitthekit`. Before signing, it installs the MPL license,
+project notice, third-party notices, licensing overview, and an exact-revision
+`SOURCE-CODE.txt` under `Contents/Resources/Legal`. The final DMG exposes the
+same `Legal/` directory at its top level.
 
 `sign-macos-app.sh` signs a staged copy and replaces the input only after the
 staged bundle passes strict verification. It signs every nested Mach-O first,

docs/development/windows-playtest-package.md

@@ -20,7 +20,9 @@ Build and package with:
 
 The script synchronizes the tested Core assembly, asks Unity for a clean
 `StandaloneWindows64` player, rejects a package containing the CoreMIDI native
-plug-in, adds player instructions, creates a ZIP, and prints its SHA-256.
+plug-in, adds player instructions and a `Legal/` directory, creates a ZIP, and
+prints its SHA-256. `Legal/SOURCE-CODE.txt` identifies the exact public Git
+revision for the MPL-covered HitTheKit files in that executable distribution.
 Generated output remains under the ignored `artifacts/game` directory.
 
 The Windows player contains `HitTheKit.exe`, `HitTheKit_Data`, Unity runtime
@@ -41,6 +43,13 @@ test the exact ZIP on clean Windows 10 and Windows 11 machines:
 6. confirm Device Setup states clearly that production MIDI is macOS-only; and
 7. collect logs and screenshots without personal paths or third-party content.
 
+## MIDI support
+
+Installing Unity Windows Build Support enables player compilation only. It
+does not provide production MIDI input. Windows electronic-drum support needs
+a separately implemented and tested Windows MIDI backend; until then the
+Windows player is keyboard-only.
+
 ## Signing and public distribution
 
 The current script intentionally creates an **unsigned playtest**. It is not a

docs/legal/ASSET_PROVENANCE.sha256

@@ -36,6 +36,7 @@ aeb85dcd4d2146f541a20b059d0202b4b74e26d36bb0c4d6a69e3216b53d32b3  branding/app-i
 33d46381305d6bfc6fd2e46756f60161d72c3dce538ad91159cb535867d8621a  branding/app-icon/web/favicon-48.png
 dd14c102c960582dce3a4a2f666acbd5fb6534aba34f065ce48ba176734e300f  branding/app-icon/web/pwa-icon-192.png
 09f9ef07c0a1e723f81ee00a8116eb2750d8d3138e679ca73f49e4d7e8652c73  branding/app-icon/web/pwa-icon-512.png
+dc7b225e09748d09fcf02c46b71f575d3d42547b4e49143da01a7710703f0ee3  branding/app-icon/windows/HitTheKit.ico
 8b02be0ccd2c4565006246b3f8ce576367bed735bc122716c28d5120c53afd70  docs/design/evidence/gameplay-environments-v2-comparison.jpg
 1503f47d91d43f2e7ea3484036329c839c338d757d6a7051e54ce97c9bd70512  docs/design/references/main-menu-stage-command-concept.png
 0a150d383929d087670d0aefe28964e3786875964f88901fe8053a96e8895321  docs/design/references/modern-drum-kit-hd-concept.png

docs/release/RELEASE_PROCESS.md

@@ -17,6 +17,8 @@ are created only from reviewed commits on `main`.
 3. Stop feature work on the candidate; only reviewed release blockers may
    change it.
 4. Record the commit SHA in the release evidence.
+5. Keep the worktree clean so `SOURCE-CODE.txt` can identify the exact public
+   revision corresponding to every executable candidate.
 
 ## 2. Run source and packaging contracts
 
@@ -95,6 +97,9 @@ Signing credentials remain outside Git. On the authorized release Mac:
 
 The pipeline must finish with `HITTHEKIT_MACOS_DISTRIBUTION_READY`. Verify the
 stapled application and each archive again after copying to the clean test Mac.
+Confirm that the application resources and DMG both include `Legal/` with
+`LICENSE`, `NOTICE`, `THIRD_PARTY_NOTICES.md`,
+`LICENSING.md`, and an exact-revision `SOURCE-CODE.txt`.
 
 ## 7. Prepare evidence
 

scripts/build-macos-distribution-app.sh

@@ -21,6 +21,13 @@ fail() {
 [ ! -e "$APP_PATH" ] || fail "output already exists: $APP_PATH"
 [ -x "$UNITY_PATH" ] || fail "Unity 6000.5.6f1 was not found at: $UNITY_PATH"
 
+SOURCE_COMMIT=${HITTHEKIT_SOURCE_COMMIT:-}
+if [ -z "$SOURCE_COMMIT" ]; then
+  [ -z "$(git -C "$REPOSITORY_ROOT" status --porcelain)" ] ||
+    fail "the release candidate must be committed and clean before building"
+  SOURCE_COMMIT=$(git -C "$REPOSITORY_ROOT" rev-parse HEAD)
+fi
+
 OUTPUT_ROOT=$(dirname -- "$APP_PATH")
 mkdir -p "$OUTPUT_ROOT"
 APP_PATH=$(cd "$OUTPUT_ROOT" && pwd)/$(basename -- "$APP_PATH")
@@ -58,6 +65,9 @@ PLIST="$APP_PATH/Contents/Info.plist"
 /usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $VERSION" "$PLIST"
 /usr/libexec/PlistBuddy -c "Set :CFBundleVersion $BUILD_NUMBER" "$PLIST"
 "$REPOSITORY_ROOT/scripts/apply-macos-app-icon.sh" "$APP_PATH"
+HITTHEKIT_SOURCE_COMMIT="$SOURCE_COMMIT" \
+  "$REPOSITORY_ROOT/scripts/install-distribution-notices.sh" \
+  "$APP_PATH/Contents/Resources/Legal" "$VERSION"
 EXECUTABLE=$(/usr/libexec/PlistBuddy -c "Print :CFBundleExecutable" "$PLIST")
 MAIN_BINARY="$APP_PATH/Contents/MacOS/$EXECUTABLE"
 

scripts/install-distribution-notices.sh

@@ -0,0 +1,69 @@
+#!/bin/bash
+set -euo pipefail
+
+SCRIPT_DIR=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
+REPOSITORY_ROOT=$(CDPATH='' cd -- "$SCRIPT_DIR/.." && pwd)
+DESTINATION=${1:-}
+VERSION=${2:-}
+SOURCE_REPOSITORY=https://github.com/Codewriter90x/HitTheKit
+
+fail() {
+  echo "distribution notices: $*" >&2
+  exit 1
+}
+
+[ -n "$DESTINATION" ] && [ -n "$VERSION" ] ||
+  fail "usage: $0 <destination-directory> <version>"
+[[ "$VERSION" =~ ^[0-9]+([.][0-9]+){1,2}([-.][0-9A-Za-z.-]+)?$ ]] ||
+  fail "version must identify a release, for example 0.5.0 or 0.5.0-rc.1"
+
+SOURCE_COMMIT=${HITTHEKIT_SOURCE_COMMIT:-}
+if [ -z "$SOURCE_COMMIT" ]; then
+  [ -z "$(git -C "$REPOSITORY_ROOT" status --porcelain)" ] ||
+    fail "the repository is dirty; commit the exact candidate or set HITTHEKIT_SOURCE_COMMIT explicitly"
+  SOURCE_COMMIT=$(git -C "$REPOSITORY_ROOT" rev-parse HEAD)
+fi
+
+[[ "$SOURCE_COMMIT" =~ ^[0-9a-f]{40}$ ]] ||
+  fail "HITTHEKIT_SOURCE_COMMIT must be a full 40-character lowercase Git SHA"
+git -C "$REPOSITORY_ROOT" cat-file -e "$SOURCE_COMMIT^{commit}" 2>/dev/null ||
+  fail "source commit is not present in this repository: $SOURCE_COMMIT"
+
+for required_file in LICENSE NOTICE THIRD_PARTY_NOTICES.md LICENSING.md; do
+  [ -f "$REPOSITORY_ROOT/$required_file" ] ||
+    fail "required legal file is missing: $required_file"
+done
+
+mkdir -p "$DESTINATION"
+install -m 0644 "$REPOSITORY_ROOT/LICENSE" "$DESTINATION/LICENSE"
+install -m 0644 "$REPOSITORY_ROOT/NOTICE" "$DESTINATION/NOTICE"
+install -m 0644 "$REPOSITORY_ROOT/THIRD_PARTY_NOTICES.md" \
+  "$DESTINATION/THIRD_PARTY_NOTICES.md"
+install -m 0644 "$REPOSITORY_ROOT/LICENSING.md" \
+  "$DESTINATION/LICENSING.md"
+
+printf '%s\n' \
+  'HitTheKit corresponding source code notice' \
+  '' \
+  "Binary version: $VERSION" \
+  "Exact source revision: $SOURCE_COMMIT" \
+  '' \
+  'The Source Code Form of MPL-2.0-covered HitTheKit files in this' \
+  'distribution is available from the exact public revision below:' \
+  '' \
+  "$SOURCE_REPOSITORY/tree/$SOURCE_COMMIT" \
+  '' \
+  'A downloadable archive of that revision is available at:' \
+  '' \
+  "$SOURCE_REPOSITORY/archive/$SOURCE_COMMIT.zip" \
+  '' \
+  'The MPL-2.0 license text, project notice, licensing overview, and' \
+  'third-party notices are included in this Legal directory.' \
+  '' \
+  'Unity and third-party components retain their own licenses and are not' \
+  'relicensed by HitTheKit.' \
+  > "$DESTINATION/SOURCE-CODE.txt"
+
+echo "HITTHEKIT_DISTRIBUTION_NOTICES_INSTALLED"
+echo "destination=$DESTINATION"
+echo "sourceCommit=$SOURCE_COMMIT"

scripts/package-game-macos-arm64.sh

@@ -1,8 +1,8 @@
-#!/bin/sh
-set -eu
+#!/bin/bash
+set -euo pipefail
 
-SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-REPOSITORY_ROOT=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
+SCRIPT_DIR=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
+REPOSITORY_ROOT=$(CDPATH='' cd -- "$SCRIPT_DIR/.." && pwd)
 UNITY_PATH=${UNITY_PATH:-/Applications/Unity/Hub/Editor/6000.5.6f1/Unity.app/Contents/MacOS/Unity}
 BUILD_VERSION=${1:-0.1.0}
 OUTPUT_ROOT=${2:-"$REPOSITORY_ROOT/artifacts/game/macos-arm64-$BUILD_VERSION"}
@@ -21,6 +21,15 @@ if [ -e "$OUTPUT_ROOT" ]; then
   exit 3
 fi
 
+SOURCE_COMMIT=${HITTHEKIT_SOURCE_COMMIT:-}
+if [ -z "$SOURCE_COMMIT" ]; then
+  [ -z "$(git -C "$REPOSITORY_ROOT" status --porcelain)" ] || {
+    echo "The playtest source must be committed and clean before packaging." >&2
+    exit 4
+  }
+  SOURCE_COMMIT=$(git -C "$REPOSITORY_ROOT" rev-parse HEAD)
+fi
+
 mkdir -p "$OUTPUT_ROOT"
 
 "$REPOSITORY_ROOT/scripts/build-coremidi-plugin-macos-arm64.sh"
@@ -51,11 +60,19 @@ cp "$SOURCE_COREMIDI_PLUGIN" "$COREMIDI_PLUGIN"
 /usr/libexec/PlistBuddy -c "Set :CFBundleShortVersionString $BUILD_VERSION" "$APP_PATH/Contents/Info.plist"
 /usr/libexec/PlistBuddy -c "Set :CFBundleVersion $BUILD_VERSION" "$APP_PATH/Contents/Info.plist"
 "$REPOSITORY_ROOT/scripts/apply-macos-app-icon.sh" "$APP_PATH"
+HITTHEKIT_SOURCE_COMMIT="$SOURCE_COMMIT" \
+  "$REPOSITORY_ROOT/scripts/install-distribution-notices.sh" \
+  "$APP_PATH/Contents/Resources/Legal" "$BUILD_VERSION"
 BINARY_NAME=$(/usr/libexec/PlistBuddy -c "Print :CFBundleExecutable" "$APP_PATH/Contents/Info.plist")
 MAIN_BINARY="$APP_PATH/Contents/MacOS/$BINARY_NAME"
 
-codesign --force --sign - "$COREMIDI_PLUGIN"
-codesign --force --deep --sign - "$APP_PATH"
+while IFS= read -r -d '' candidate; do
+  [ "$candidate" != "$MAIN_BINARY" ] || continue
+  if file -b "$candidate" | grep -q 'Mach-O'; then
+    codesign --force --sign - "$candidate"
+  fi
+done < <(find "$APP_PATH/Contents" -type f -print0)
+codesign --force --sign - "$APP_PATH"
 
 test -x "$MAIN_BINARY"
 test -f "$COREMIDI_PLUGIN"
@@ -65,6 +82,7 @@ codesign --verify --deep --strict --verbose=2 "$APP_PATH"
 
 mkdir -p "$PACKAGE_ROOT"
 cp -R "$APP_PATH" "$PACKAGE_ROOT/HitTheKit.app"
+ditto "$APP_PATH/Contents/Resources/Legal" "$PACKAGE_ROOT/Legal"
 printf '%s\n' \
   'HitTheKit macOS Apple Silicon playtest' \
   '' \
@@ -74,6 +92,7 @@ printf '%s\n' \
   '' \
   'This early playtest is ad-hoc signed and not yet Apple-notarized.' \
   'No Unity installation is required.' \
+  'License, notices, and exact source information are in Legal/.' \
   > "$PACKAGE_ROOT/README-FIRST.txt"
 
 ditto -c -k --sequesterRsrc --keepParent "$PACKAGE_ROOT" "$ZIP_PATH"

scripts/package-game-windows-x64.sh

@@ -20,8 +20,16 @@ OUTPUT_ROOT=${OUTPUT_ROOT:-"$REPOSITORY_ROOT/artifacts/game/windows-x64-$VERSION
 [ ! -e "$OUTPUT_ROOT" ] || fail "output directory already exists: $OUTPUT_ROOT"
 [ -x "$UNITY_PATH" ] || fail "Unity 6000.5.6f1 was not found at: $UNITY_PATH"
 
+SOURCE_COMMIT=${HITTHEKIT_SOURCE_COMMIT:-}
+if [ -z "$SOURCE_COMMIT" ]; then
+  [ -z "$(git -C "$REPOSITORY_ROOT" status --porcelain)" ] ||
+    fail "the playtest source must be committed and clean before packaging"
+  SOURCE_COMMIT=$(git -C "$REPOSITORY_ROOT" rev-parse HEAD)
+fi
+
 UNITY_APP=$(CDPATH='' cd -- "$(dirname -- "$UNITY_PATH")/../.." && pwd)
-WINDOWS_SUPPORT="$UNITY_APP/Contents/PlaybackEngines/WindowsStandaloneSupport"
+UNITY_INSTALL_ROOT=$(CDPATH='' cd -- "$UNITY_APP/.." && pwd)
+WINDOWS_SUPPORT="$UNITY_INSTALL_ROOT/PlaybackEngines/WindowsStandaloneSupport"
 [ -d "$WINDOWS_SUPPORT" ] || \
   fail "Unity Windows Build Support (Mono) is not installed for 6000.5.6f1"
 
@@ -56,6 +64,10 @@ UNEXPECTED_PLUGIN=$(find "$PLAYER_ROOT" -iname '*HitTheKitCoreMidi*' -print -qui
 [ -z "$UNEXPECTED_PLUGIN" ] || \
   fail "macOS CoreMIDI plug-in leaked into the Windows package: $UNEXPECTED_PLUGIN"
 
+HITTHEKIT_SOURCE_COMMIT="$SOURCE_COMMIT" \
+  "$REPOSITORY_ROOT/scripts/install-distribution-notices.sh" \
+  "$PLAYER_ROOT/Legal" "$VERSION"
+
 printf '%s\n' \
   'HitTheKit Windows x64 playtest' \
   '' \
@@ -66,6 +78,7 @@ printf '%s\n' \
   'Electronic-drum MIDI is not implemented on Windows yet.' \
   'This playtest package is unsigned and is not approved for public release.' \
   'Verify the published SHA-256 before running any future release package.' \
+  'License, notices, and exact source information are in Legal/.' \
   > "$PLAYER_ROOT/README-FIRST.txt"
 
 ditto --norsrc --noextattr -c -k --keepParent "$PLAYER_ROOT" "$ZIP_PATH"

scripts/package-macos-dmg.sh

@@ -31,6 +31,9 @@ resolve_identity() {
   fail "usage: $0 <notarized-HitTheKit.app> <output.dmg>"
 [[ "$APP_PATH" == *.app ]] || fail "input must be an .app bundle"
 [ -d "$APP_PATH/Contents" ] || fail "app bundle does not exist or is invalid: $APP_PATH"
+LEGAL_SOURCE="$APP_PATH/Contents/Resources/Legal"
+[ -f "$LEGAL_SOURCE/SOURCE-CODE.txt" ] ||
+  fail "app bundle lacks the MPL source disclosure: $LEGAL_SOURCE/SOURCE-CODE.txt"
 [[ "$OUTPUT_DMG" == *.dmg ]] || fail "output must use the .dmg extension"
 [ ! -e "$OUTPUT_DMG" ] || fail "output already exists: $OUTPUT_DMG"
 
@@ -59,6 +62,7 @@ trap cleanup EXIT INT TERM
 
 mkdir -p "$STAGE_ROOT"
 ditto "$APP_PATH" "$STAGE_ROOT/HitTheKit.app"
+ditto "$LEGAL_SOURCE" "$STAGE_ROOT/Legal"
 ln -s /Applications "$STAGE_ROOT/Applications"
 hdiutil create -quiet -volname "HitTheKit" -srcfolder "$STAGE_ROOT" -format UDZO "$TEMP_DMG"
 hdiutil verify "$TEMP_DMG" >/dev/null